Document-borne AI worms can self-propagate through Copilot for Word
1–10 of 317 posts
Re: Document-borne AI worms can self-propagate through Copilot for Word
#2Author here.
This post covers a coordinated disclosure with Microsoft (MSRC) regarding a vulnerability class that allows attacker-controlled instructions in an attached document to hijack Copilot for Word.
It manipulates the AI to alter the output text (e.g., halving financial figures) and append the attack prompt into the new document concealed as white text.
Because the downstream document now carries the payload, it acts similarly to an AI worm across normal user workflows. Microsoft deployed multiple fixes over a 144-day coordination period, but the broader vulnerability class remains unmitigated and exploitable because it exploits fundamental limitations of current LLMs.
When attacker instructions are combined with legitimate information the model's context window, the tokens being inspected participate in the act of inspection, meaning current LLM architectures provide no reliable boundary between intention and interpretation.
Re: Document-borne AI worms can self-propagate through Copilot for Word
#3“ At the time of publication, no robust mitigation for the broader vulnerability class is available.”
Well, that sounds promising..
Re: Document-borne AI worms can self-propagate through Copilot for Word
#4[deleted]
Re: Document-borne AI worms can self-propagate through Copilot for Word
#5> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
Re: Document-borne AI worms can self-propagate through Copilot for Word
#6> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents. Oh no.
something something lethal trifecta
Re: Document-borne AI worms can self-propagate through Copilot for Word
#7Why is it possible to have hidden text in a Word document? Why should the AI have access to that text?
Re: Document-borne AI worms can self-propagate through Copilot for Word
#8Why is it possible to have hidden text in a Word document? Why should the AI have access to that text?
The same reason to why you let AI have access to your filesystem. Idiocy, you need to teach AI to be smart somehow.
You train a monkey to learn from a bunch of lower level intelligence monkeys. The same applies for AI. Just this time we are the monkeys.
Re: Document-borne AI worms can self-propagate through Copilot for Word
#9Why is it possible to have hidden text in a Word document? Why should the AI have access to that text?
It’s the good old white text on white background. Not really a way to defend against this, except having a no-style or high contrast mode that people actually use. Maybe some warning that would trigger if text is too small, off page or has very low contrast would help?
Re: Document-borne AI worms can self-propagate through Copilot for Word
#10I may be naive here but can the hidden text not be flagged or outright removed before being passed to copilot? Why would there not be consideration for what a human user can see, especially if the hidden text was added by copilot in the first place?